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ABSTRACT:  Graceful  Degradation:  A  C2  Design  Virtue  for  Our  Times 


Graceful  degradation,  or  fault  tolerance  in  engineering  terms,  refers  to  the  ability 
of  systems  to  continue  functioning,  at  least  for  a  time,  after  critical  processes  or 
sub-systems  are  compromised  or  destroyed.  One  popular  concept  of  recent 
times,  resilience,  attempts  to  capture  the  graceful  degradation  idea.  However, 
resilience  is  insufficient  to  account  for  a  system  that  has  the  quality  of  graceful 
degradation.  Two  other  related  concepts,  robustness  and  redundancy, 
complement  resilience. 

This  paper  describes  graceful  degradation  and  its  accompanying  concepts,  and 
applies  them  to  Command  and  Control  theory.  It  argues  that  graceful 
degradation  needs  to  be  designed  into  our  organizational  as  well  as  our 
technological  C2  systems.  It  points  out  that  the  new  emphasis  on  mission 
command  is  one  necessary  and  desirable  approach  to  incorporating  graceful 
degradation  in  Command  and  Control,  but  it  is  insufficient.  The  paper  concludes 
that  graceful  degradation  needs  to  be  inculcated  in  the  minds  of  leaders  such 
that  they  apply  the  concept  as  a  matter  of  course,  rather  than  conscious 
application.  The  paper  includes  cases  illustrating  the  points  of  argument. 

Setting  -  A  Historical  Example 

About  0125  hours,  Friday,  13  November  1942,  an  American  naval  task 
force  intercepted  a  powerful  Japanese  naval  force  en  route  to  a  bombardment 
mission  off  Guadalcanal.  The  USS  SAN  FRANCISCO,  a  heavy  cruiser,  was  the 
flagship  of  the  Americans.  At  pointblank  range  for  naval  engagements,  less  than 
3,000  meters,  the  Americans  opened  fire.  After  forty-five  minutes  of  brutal 
exchanges  of  naval  gunfire,  both  sides  withdrew,  the  Americans  claiming  a 
victory  of  sorts  because  the  Japanese  did  not  complete  the  bombardment  of 
American  positions  on  Guadalcanal.  Eight  of  the  thirteen  American  ships  were 
sunk  by  the  Japanese  and  all  but  one  of  the  survivors  suffered  moderate  to 
heavy  damage.  One  of  the  survivors  was  the  SAN  FRANCISCO;  the  ship  received 
forty-five  hits  from  guns  ranging  in  size  from  five  inch  to  fourteen  inch.  During 
the  battle,  the  SAN  FRANCISCO  received  a  direct  hit  to  the  command  and  control 
center  of  the  ship,  the  navigation  bridge.  The  senior  surviving  officer 
transferred  command  to  the  alternate  command  post  known  as  Battle  Two. 

Then,  a  Japanese  shell  disabled  Battle  Two.  The  ship's  acting  commander 
transferred  command  back  to  the  bridge.  Finally,  another  enemy  round  again  hit 
the  bridge,  disabling  command  and  control.  Remarkably,  even  without  electronic 
communications,  the  commander  was  able  to  reestablish  engine  control  and 
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steering  with  fire  control  under  local  command.  The  SAN  FRANCISCO  continued 
to  fire  into  the  enemy  throughout  the  several  instances  of  loss  of  command  and 
control  and  finished  the  battle.  Eventually,  the  ship  returned  to  Mare  Island 
Naval  Base  for  repairs  and  served  in  several  subsequent  naval  campaigns,  ending 
naval  service  in  1946. 1 

Introduction 

This  paper  introduces  the  systems  concept  of  graceful  degradation  to  the 
discussion  of  military  command  and  control.  Graceful  degradation  is  a  desirable 
characteristic  -  a  virtue  as  described  herein  -  of  systems  that  allows  them  to 
continue  functioning  with  some  capacity  even  with  the  failure  of  some  critical 
components  and  processes,  with  the  functionality  proportionate  to  the  failure(s). 
The  above  vignette  concerning  the  USS  SAN  FRANCISCO  during  the  First  Naval 
Battle  of  Guadalcanal  serves  as  an  excellent  illustration  of  what  command  and 
control  graceful  degradation  looks  like  in  real  operations.  This  characteristic  has 
three  related  facets,  in  the  context  of  living,  specifically  human-in-the-loop 
systems:  (1)  hardware  or  equipment;  (2)  software,  doctrine,  or  procedures  that 
prescribe  how  to  use  the  hardware;  and  (3)  the  human(s)  who  operate  the 
hardware  using  the  software  associated  with  the  equipment.  To  illustrate  these 
relationships,  consider  in  the  preceding  vignette  that  the  ship  and  its  various 
subsystems  to  be  the  hardware,  the  software  or  standard  operating  procedures 
informed  the  surviving  leaders  how  and  where  to  locate  command  and  control  of 
the  ship,  and  the  humans  involved  were  the  key  leaders  of  the  crew. 

To  accomplish  its  task,  the  paper  progresses  through  four  sections. 
Following  this  first  introductory  section,  it  secondly  provides  definitions  and 
context  of  the  term  and  its  close  conceptual  relative,  resiliency.  Third,  the  paper 
briefly  examines  six  historical  cases,  three  considering  successful  human, 
software  and  hardware  aspects  of  graceful  degradation,  and  three  considering 
unsuccessful  aspects.  Fourth  and  finally,  the  paper  concludes  with  some 
observations  and  recommendations  on  future  research  and  practice  incorporating 
the  graceful  degradation  virtue. 

Graceful  Degradation  in  Context 

Various  terms  have  been  used  in  the  past  to  describe  the  ability  of  a  system 
to  continue  functioning,  at  least  for  a  time,  after  critical  processes  or  sub¬ 
systems  are  compromised  or  destroyed.  The  terms  fault  tolerance,  fault 
tolerance  computing,  and  graceful  degradation  were  all  used  within  the  systems 
engineering  discipline  to  describe  the  property(ies)  that  enables  a  system  to 
continue  operating  properly  in  the  event  of  the  failure  (or  one  or  more  faults 
within)  some  of  its  components.  Within  the  materials  science  field,  the  term 
resilience  has  been  used  to  understand  the  behavior  and  properties  of  specific 
materials  when  an  external  force  is  applied  to  the  material.  More  recently,  the 
resilience  concept  has  been  applied  in  a  number  of  other  discrete  fields  such  as: 
psychology,  socio-ecological  systems,  disaster  response,  and  critical 
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infrastructure  protection.  Each  of  these  domains  has  viewed  the  graceful 
degradation  or  resilience  concept  from  the  perspective  of  the  problems  they 
were  trying  to  solve,  hence  there  is  no  unified  theory  or  concept  of  resilience.2 
However,  two  related  concepts  -  robustness  and  redundancy  -  are  common 
throughout  the  discussions  and  each  of  these  fields  and  their  perspective  of 
resilience  have  insights  which  can  assist  in  designing  future  military  C2  systems. 
This  paper  conceives  of  the  relationship  between  resilience  and  graceful 
degradation  to  be  similar  to  that  of  output  and  outcome  of  a  system:  resilience  is 
necessary,  but  not  sufficient  for  graceful  degradation.  However,  the  relationship 
is  quite  close;  as  mentioned  above,  the  lack  of  an  integrated  conception,  theory 
or  model  of  resilience  or  graceful  degradation  across  disciplines  makes  it 
impossible  to  state  a  clear,  non-controversial  relationship.  One  should  conceive 
of  this  paper's  conception  as  axiomatic  within  its  context. 


Robustness 

Resistanceto  change 

Resistanceto  uncertainty 

K 

System  _ 

^  Graceful 

^  System 
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Figure  1 :  Relationship amongKeyTermsforGraceful  Degradation 


Robustness  refers  to  the  strength  of  a  system.  It  can  be  expressed  as  a 
probabilistic  resistance  to  failure  across  the  possible  system  states:  to  changes 
from  within  and  without  the  system,  and  to  uncertainties  associated  with  a 
system's  several  processes.  Redundancy  can  be  construed  as  the  complement  of 
robustness;  it  too  refers  to  system  strength,  but  in  terms  of  a  multiplicity  of 
probable  system  operational  capabilities,  again  across  all  possible  system  states.3 
Redundancy  can  be  active  or  passive.  Active  redundancy  occurs  when  there  are 
more  than  one  alternative  system  components  that  accomplish  the  same  thing; 
the  systems  fails  only  when  all  components  fail.  For  example,  consider  alternate 
communications  means  routing  between  military  command  centers,  one  possible 
alternate  being  via  radio,  another  being  via  fiber  optic  or  wire  cable;  messages 
can  be  passed  across  all  means  without  overall  communications  system  failure  . 
Passive  redundancy  occurs  when  at  least  one  backup  system  component  exists 
ready  to  operate  if  primary  capabilities  fail,  but  is  not  operational.  An  example  is 
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a  homeowner's  backup  generator  for  use  when  public  utilities  are  interrupted.4 
It  is  important  to  note  the  use  of  the  term  probabilistic  in  the  discussion  of 
resilience,  robustness,  redundancy,  and  graceful  degradation.  Uncertainties  of 
occurance  with  unknown  probability  distributions  inhabit  the  universe  of  complex 
adaptive  systems  (CAS),  like  command  and  control  (C2)  systems.  In  the 
following  sections,  oftentimes  probabilistic  is  not  explicitly  used,  but  readers 
should  understand  that  it  is  always  meant. 

The  single  overarching  goal  for  applying  the  concepts  of  graceful 
degradation,  fault-tolerance  or  resilience  across  all  these  fields  is  to  achieve 
system  sustainability  -  the  ability  of  the  system  to  meet  current  system  demands 
without  eroding  the  potential  to  meet  future  needs.  The  preponderance  of 'best 
practices'  have  been  based  on  a  philosophy  of  optimizing  a  small  subset  of  the 
components  in  the  system  in  order  to  achieve  the  sustainable  delivery  of  goods 
and  services  through  the  efficient  use  of  resources.  In  the  absence  of  applying  a 
methodology  such  as  Goldratt's  Theory  of  Constraints5,  this  optimization 
approach  leads  to  the  elimination  of  redundancies  and  aims  to  get  a  system  into 
some  particular  'optimal  state'  and  then  hold  it  there.  This  approach,  however, 
leads  to  the  paradoxical  drastic  loss  of  system  resilience,  making  the  total  system 
more  vulnerable  to  shocks  and  disturbances.6 

All  C2  systems  have  a  common  fundamental  purpose:  to  sustain  internal 
system  cohesion  in  the  presence  of  external  environmental  changes.  This 
purpose  requires  all  C2  systems  to  perform  two  activities:  Command:  directing  a 
system  to  execute  an  iterative  process  of  observing  external  changes,  making 
sense  of  those  changes,  deciding  how  to  adapt  to  those  changes,  implementing 
that  adaptation,  and  then  receiving  feedback  as  to  the  effectiveness  of  the 
adaption  and  its  impact  on  the  environment:  and,  Control:  regulate  the  critical 
internal  processes  of  the  system  . 

_ Our  current  military  C2  systems  have  been  designed  to  optimize  a 

commander's  ability  to  make  decisions.  Throughout  the  remainder  of  the  paper, 
we  will  describe  the  lessons  learned  in  applying  resilience,  robustness,  and 
redundancy  from  the  various  fields  above  and  in  the  case  studies  as  they  relate 
to  the  three  aspects  of  our  C2  system:  hardware  (technology),  software 
(doctrine,  procedures),  and  the  human  integration  of  the  two. 

Graceful  Degradation/ Resilience  by  Applicable  Domain 

Of  the  various  fields  who  have  applied  the  concepts  of  graceful  degradation 
or  resilience,  four  have  the  most  insights  for  applying  these  concepts  to  our  C2 
system.  The  four  domains  in  increasing  complexity  are:  materials  engineering 
(engineering  resilience),  systems  engineering  (systems  resilience),  social- 
ecological  system  management  (resilience  in  a  CAS),  and  critical  infrastructure 
management  (resilience  in  a  CAS  with  intentionally  adversarial  actors).  Our  C2 
system  will  have  aspects  that  best  reflect  one  (or  more)  of  these  domains  and 
any  actions  we  might  take  to  ensure  graceful  degradation  should  be  informed  by 
the  insights  from  those  domains. 
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Engineering  Resilience 

At  the  simplest  individual  component  level,  engineering  resilience  focuses 
resilience,  redundancy,  and  robustness  on  a  discrete  part  of  a  larger  system. 
Resilience  at  this  level  is  focused  on  designing  the  system  to  endure  greater 
stress  without  becoming  damaged,  rapidly  return  to  a  normal  condition,  and 
"distort"  less  as  a  result  of  the  stress  -  essentially  to  prevent  or  minimize 
change,  avoid  staying  too  long  in  the  disruptive  state  and  decrease  the  risk  and 
severity  of  disturbances.  At  this  level,  resilience  and  robustness  are  essentially 
equivalent.  Of  critical  importance  when  applying  lessons  learned  from  this 
domain  is  in  understanding  the  underpinning  assumptions:  1)  there  is  only  one 
equilibrium  or  normal  state,  2)  the  object  returns  to  this  state  after  a  disturbance 
it  can  handle,  and  3)  the  type  of  disturbances  are  expected.7  Redundancy  at  this 
level  is  concerned  with  the  provision  of  functional  capabilities  that  would  not  be 
necessary  in  a  fault-free  environment  (duplication).8  In  addition  to  resilience, 
robustness  and  redundancy,  being  properties  of  individual  machines  within  the 
system,  it  may  also  characterize  the  rules  by  which  they  interact.  The  means  by 
which  graceful  degradation  is  achieved  include:  anticipating  exceptional 
conditions  and  building  the  system  to  cope  with  them,  aiming  for  self¬ 
stabilization,  building  in  some  form  of  duplication  (redundancy),  etc. 

Systems  Resilience 

Within  the  systems  engineering  domain  the  focus  is  at  the  scale  of  groups  of 
interacting  agents  -  non-linear,  dynamical  systems.  Even  though  these  systems 
are  deterministic  -  that  is  the  behaviors  of  the  agents  in  the  system  and  their 
relationships  to  each  other  follow  established  rules  which  do  not  change  -  that 
does  not  mean  these  systems  are  predictable.  These  type  systems  can  exhibit 
extremely  complex  behavior.  What  these  systems  lack  is  an  ability  to  self-adapt 
and  change.9  Examples  of  this  type  system  are  the  various  human-designed 
infrastructure  systems  (communications,  transportation,  electrical,  computer, 
etc.)  with  the  human-in-the-loop  removed.  Since  these  systems  do  not  exist  as 
stand-alone  systems  (without  any  human  interaction),  a  more  detailed  discussion 
of  resilience,  robustness  and  redundancy  is  better  left  to  the  next  two  domains  of 
complexity. 

Resilience  in  a  Complex  Adaptive  System  (CAS) 

The  next  domain,  social-ecological  management,  has  been  exploring  the 
concepts  of  resilience  for  the  last  four  decades  as  the  result  of  many  well 
publicized  failures  of  well-intentioned  traditional  environmental  management 
approaches.  Resilience  at  this  level  is  best  defined  as  the  ability  of  the  system  as 
a  whole  to  withstand,  recover  from  and  still  retain  its  basic  function  and  structure 
or  to  reorganize  in  response  to  a  crisis.  The  key  feature  of  resilience  in  a  CAS  is 
the  ability  of  that  system  to  generate  new  ways  of  operating  and  new  systemic 
relationships  -  its  adaptive  capacity.10  The  most  significant  aspect  of  a  social- 
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ecological  system  that  we  must  keep  in  mind  in  applying  any  lessons  learned  to  a 
C2  system  is  the  fact  that  all  the  "parts"  of  a  social-ecological  system  are 
inherently  adaptable  -  nature  has  already  "built-in"  a  degree  of  resilience, 
robustness  and  redundancy.  Not  all  parts  of  a  C2  system  have  this  "built-in" 
adaptability.  Robustness  at  this  level  provides  a  level  of  physical  and 
physiological  tolerance  to  stress  within  the  parts  of  the  system  that  allows  them 
to  cope  and  survive,  in  a  potentially  degraded  state,  long  enough  to  adapt  to  the 
stress.  Robustness  within  the  system  as  a  whole  can  be  achieved  either:  1)  by 
having  redundant  parts,  where  multiple  components  within  the  system  have  the 
same  function;  or,  2)  through  distributed  robustness,  where  different 
components  within  the  system  having  different  functions,  can  still  produce  a 
comparable  end-product.11 

To  this  point,  the  discussions  of  resilience,  robustness  and  redundancies  have 
predominately  pertained  to  the  hardware  and  software  aspects  of  a  system.  It  is 
at  this  level  where  we  first  encounter  the  human  integration  of  the  two.  One  of 
the  key  features  that  changed  in  the  transition  from  traditional  environmental 
management  approaches  to  those  that  embrace  the  concepts  of  resilience,  was 
the  recognition  that  humans  are  part  of  the  system.12  Human  institutions  and 
governance  structures  cannot  be  separated  from  the  systems  that  they  operate 
or  manage;  and,  these  institutions  and  governance  structures  are  critical  in 
promoting  innovation  which  is  critical  for  building  resiliency.13  The  human 
component  of  any  system  provides  the  greatest  source  of  adaptability  and 
resilience. 

Resilience  in  an  Adversarial  CAS 

Another  domain  that  has  focused  on  resiliency  has  been  disaster 
management.  Within  this  domain,  the  9-11  attacks  in  the  United  States  added  a 
threat  to  the  natural  hazards  that  had  already  been  considered  -  that  of 
intentional  damage  from  the  actions  of  an  adversary,  particularly  to  those 
infrastructure  systems  that  are  critical  to  support  large  urban  areas.  These 
infrastructure  systems  have  evolved  to  become  tightly  coupled,  complex  systems 
where  all  of  these  systems  influence  each  other  establishing  circular,  reciprocal 
interdependencies  -  where  a  failure  in  one  system  causes  failures  in  all  other 
systems  which  in  turn  reinforce  the  failure  in  the  original  system.14  Due  to  these 
relationships  between  critical  infrastructure  systems,  a  simple  disturbance  in  one 
system  can:  1)  cause  a  failure  in  a  second  infrastructure  system  (a  cascading 
failure);  or,  2)  exacerbate  a  disruption  in  a  second  system  (an  escalating 
failure).15  Within  this  domain,  the  presence  of  an  adversary  requires  an 
additional  dimension  be  addressed  within  graceful  degradation  -  that  of 
protection.16  Our  C2  system  reflects  many  of  the  aspects  of  this  domain  with  the 
multiple  interdependent  infrastructure  systems  (e.g.  satellites,  communications, 
electrical  systems,  network  management  systems,  intelligence  collection 
systems,  etc.),  as  well  as,  the  presence  of  an  adversary  who  is  intentionally 
attempting  to  degrade  our  C2  capabilities. 
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Cases 


All  systems,  including  C2  systems,  exhibit  graceful  degradation  to  a 
greater  or  lesser  degree.  This  occurs  by  virtue  of  the  interaction  of  all  three 
aspects  of  their  design:  hardware  (technology),  software  (doctrine,  procedures, 
instructions),  and  the  human  interface  between  hardware  and  software 
producing  system  operations.  In  the  following  cases,  therefore,  though  one 
aspect  is  emphasized  over  the  others,  the  illustration  is  one  of  degree,  not 
exclusion.  In  the  world  of  systems,  no  one  aspect  or  part  can  be  understood 
without  the  context  of  all  the  others;  they  are  interrelated. 

Six  cases  of  graceful  degradation  are  presented  in  brief  here.  Each 
highlights  one  aspect  of  graceful  degradation,  either  a  successful  or  unsuccessful 
incorporation  of  graceful  degradation,  in  the  C2  system. 

Case  One:  Successful  Hardware  Graceful  Degradation 

This  is  the  case  of  the  USS  SAN  FRANCISCO,  described  in  the  "Setting  -  A 
Historical  Example"  section  of  this  paper.  This  ship  was  resilient  to  an  extreme, 
taking  unprecedented  damage  while  both  surviving  its  terrific  battle  at  sea,  and 
continuing  to  perform  its  primary  function  as  a  maritime  weapons  system  of  war 
-  deliver  naval  surface  fires  in  battle.  The  ship's  command  and  control  system 
had  to  survive  in  order  to  enable  functioning;  it  did  even  though  many  of  the 
humans  (naval  officers)  in  charge  of  the  command  and  control  system  died 
during  the  battle.  The  command  and  control  system  was  sufficiently  robust  to 
sustain  significant  damage  to  the  ship's  command  and  control  center,  the  bridge, 
so  that  following  a  brief  use  of  a  passive  redundant  command  and  control 
system,  the  aft  battle  command  center,  the  senior  surviving  officer  was  able  to 
reassert  command  and  control  of  the  ship  from  the  bridge.  The  ship's  physical 
architecture  had  graceful  degradation  built  into  its  design. 

Case  Two:  Unsuccessful  Hardware  Graceful  Degradation 

The  initial  governmental  effort  to  coordinate  emergency  efforts  in  the 
wake  of  Hurricane  Katrina  in  2005  provides  the  counter-case  to  the  USS  SAN 
FRANCISCO.  So  faulty  were  the  C2  systems  and  efforts  that  the  formal 
Congressional  after  action  report  dedicated  an  entire  chapter  to  the  failure.17 
Generally,  there  was  a  complete  and  catastrophic  breakdown  in  communications 
between  federal  and  state  emergency  operations  centers  and  the  local 
emergency  operations  centers  in  the  affected  areas  of  Katrina,  primarily  those  in 
and  around  the  city  of  New  Orleans.  The  major  reason  for  this  failure  was  the 
inundation  of  the  staging  area  for  emergency  electrical  power,  Army  National 
Guard  portable  generators,  located  at  the  State  National  Guard's  headquarters, 
Jackson  Barracks.  Apparently,  no  one  in  authority  had  considered  the  fact  that 
the  headquarters  was  situated  in  one  of  the  lowest  parts  of  the  city.  Once  the 
levees  were  breached,  the  headquarters  area  was  one  of  the  first  areas  flooded. 
The  primary  planned  capacity  to  provide  emergency  electrical  power,  which 
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enables  the  command  and  control  system  to  continue  to  function,  was 
compromised  within  the  first  hours  of  the  crisis. 

The  emergency  plans  for  C2  in  the  case  of  Katrina  were  sufficiently 
robust;  there  were  plenty  of  emergency  portable  generators  staged  to  New 
Orleans.  However,  staging  them  all  at  the  headquarters,  a  critically  vulnerable 
location,  set  up  the  entire  command  and  control  system  for  a  single  fault  failure 
-  in  this  case,  flooding.  There  was  little  substantial  active  communication 
redundancy:  cell  phone  towers  had  been  flattened  by  the  storm,  telephone 
cables  compromised  by  floodwaters,  and  only  sporadic  radio  contact  through  a 
few  commercial  stations  that  had  their  own  independent  emergency  power 
sources.  The  brittleness  of  the  communications  planning  for  Katrina  coupled 
with  a  significant  lack  of  redundancy  meant  that  resilience  of  the  C2  systems  was 
low.  Graceful  degradation  for  local  emergency  operations  centers  in  Louisiana 
during  Hurricane  Katrina  was  virtually  nonexistent.18 

Case  Three:  Successful  Software  Graceful  Degradation 

The  illustration  for  this  case  is  one  of  the  latest  historical  examples  of 
mission  command,  the  Battle  of  Wanat,  also  known  as  the  battle  for  Command 
Out-Post  (COP)  Kahler.19  Mission  command,  derived  from  the  old  German  C2 
method  auftragstaktik,  radically  decentralizes  command  authority  to  the  lowest 
appropriate  level,  empowering  even  the  most  junior  unit  leaders  to  take  the 
initiative,  changing  or  even  violating  written  orders,  in  consonance  with  the 
overall  commander's  expression  of  what  he/she  intended  to  happen.20  Three 
unit  conditions  must  exist  for  mission  command  to  work:  understanding,  trust 
and  intent.21  When  these  conditions  are  met,  and  a  mission  command  process  is 
in  place,  C2  systems  become  extremely  agile,  often  approaching  "edge-like" 
qualities.22  At  the  battle  for  Wanat,  these  conditions  existed,  and  the  result  was  a 
combat  engagement  in  which  a  severely  outmanned  and  outgunned  American 
infantry  unit  successfully  defended  a  very  vulnerable  combat  outpost. 

The  American  outpost  at  Wanat  was  at  the  end  of  a  line  of  operation  into 
the  Waigul  Valley  in  northeast  Afghanistan.  It  was  supposed  to  be  a  temporary 
location  as  American  forces  slowly  consolidated  their  positions  around  the  main 
population  centers  in  the  region;  this  consolidation  was  necessary  due  to  the 
existing  economy-of-force  environment  among  allied  forces  throughout 
Afghanistan.  An  American  infantry  platoon,  only  two  weeks  from  redeploying  to 
its  home  station  in  the  United  States,  drew  the  mission  of  establishing  and 
initially  manning  this  outpost.  The  location  is  shown  in  Figure  2  following: 
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Figure  2:  Location  of  Outpost  and  Battle  for  Wanat 


Though  a  temporary  outpost,  the  negotiations  with  local  tribal  leaders  had  been 
ongoing  for  more  than  six  months,  thus  allowing  the  enemy  forces,  primarily 
Taliban,  to  know  where  the  outpost  was  specifically  situated,  and  its 
configuration.  The  Taliban  decided  to  use  this  intelligence  to  plan  an  assault  on 
the  outpost  during  its  most  vulnerable  period,  that  of  initial  establishment. 

The  American  unit,  2nd  Platoon,  C  Company,  503rd  Infantry  (ABN),  with 
Afghan  Army  reinforcements  had  approximately  75  soldiers,  led  by  a  1st 
Lieutenant  Jonathan  Brostrom.  Also  on  hand  was  his  company  commander, 
Captain  Matthew  Myer.  In  the  early  hours  of  13  July  2008,  between  200  and 
500  enemy  combatants  assaulted  the  outpost.  Though  nine  (9)  soldiers  died, 
including  Brostrom,  and  forty-seven  (47)  were  wounded,  the  unit  held  the 
outpost. 

There  are  two  schools  of  thought  on  why  the  outmanned  American  and 
Afghan  unit  was  able  to  repel  the  attack.  One  line  of  thinking  focuses  on  the 
tactical  incompetence  of  the  attackers:  though  they  had  the  elements  of  surprise 
and  overwhelming  numbers,  their  proficiency  with  arms  and  coordinated  action 
were  lacking.23  This  interpretation  understates  the  role  of  the  American  soldiers 
involved  in  the  combat. 

The  second  line  of  thinking  on  the  battle,  captured  in  the  Combat  Studies 
Institute  report  on  the  engagement,  points  to  the  doctrine,  discipline,  and 
courage  of  the  unit  and  soldiers  involved  in  the  battle.  Even  though  the  formal 
C2  personnel  of  the  unit  were  killed  or  wounded,  others  immediately  stepped 
into  their  place  and  continued  the  defense;  this  behavior  is  consistent  with  U.S. 
Army  training  doctrine.  Through  the  soldiers'  high  level  of  training,  the 
robustness  of  the  C2  system  enabled  the  unit  to  perform  under  most  distressing 
circumstances.  Also,  the  active  and  passive  redundancy  inherent  in 
decentralized  C2  -  in  this  case,  individual  soldiers  -  reinforced  the  system's 
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robustness.  What  resulted  was  an  extremely  resilient  C2  system  that  was  able  to 
accept  extreme  damage  (over  80%  unit  casualties),  and  still  function. 

Case  4:  Unsuccessful  Software  Graceful  Degradation 

"No  one  knows  exactly  what  is  going  on. "  Message  from  Headquarters, 

First  Army  to  Headquarters,  Northeastern  Front,  13  May  194024 

The  converse  of  mission  command  is  positive  C2.  This  form  of  C2  works 
well  with  situations  and  environments  that  are  well  understood,  and  relatively 
constant;  for  example,  assembly  lines  in  factories.  In  these  environments,  C2 
systems  doctrine  assumes  security  and  reliability;  they  are  sufficiently  robust. 

Risk  of  C2  systems  failure  shifts  to  redundancy  and  resilience:  because  both 
these  characteristics  require  resource  investments  not  directly  associated  with 
outputs,  the  necessary  doctrine  guiding  implementation  of  C2  hardware  is  not  in 
place.  The  C2  system  becomes,  in  a  word,  brittle.25  If  positive  C2  systems  are 
applied  to  conditions  outside  the  parameters  for  which  they  are  designed,  the 
opportunity  for  catastrophic  system  failure  becomes  not  only  possible,  but 
probable.  This  is  the  case  of  the  Allied  response  to  the  German  invasion  of 
France  in  April,  1940,  Operation  Fall  Geib. 

The  facts  of  the  Fall  Gelb  are  well  known  and  well  documented.26  The 
Germans  took  advantage  of  an  Allied  oversight  of  the  operational  situation,  the 
assumption  that  armored  forces  could  not  be  employed  in  the  heavy  forested 
region  of  the  Ardennes,  Belgium;  they  used  this  advantage  to  impose  a  pace  of 
operational  action  that  completely  mystified  the  Allied  high  command.  Allied 
commanders  and  their  staffs  could  not  keep  up  with  critical  events  and  actions 
happening  across  their  front.  The  result  was  a  complete  victory  for  the  Germans 
and  an  unexpected  catastrophic  defeat  for  the  Allies  (and  a  complete  defeat  for 
the  French.)  Undeniably,  the  origin  of  German  victory  is  the  operational  and 
tactical  surprise  that  they  achieved,  particularly  in  the  most  vulnerable  part  of 
the  front,  that  part  of  France,  including  the  city  of  Sedan,  facing  the  Ardennes. 
Beyond  that,  though  the  German  victory  can  reasonably  be  argued  to  be  one  of 
arms,  the  reality  was  that  Germans  first  defeated  the  Allied  C2  systems,  forcing  a 
brittle  C2  system  to  unsuccessfully  adapt  when  its  doctrine  of  positive  centralized 
C2  attempted  to  enable  Allied  High  Command  to  impose  its  presence  on  a  fluid 
battlefield  environment.  Then  the  Germans  took  advantage  of  the  ensuing 
confusion  to  force  the  decision  through  fast-paced  actions. 

Allied  C2  systems  doctrine  worked  quite  differently  from  the  Germans. 
Allied  High  Command,  physically  situated  a  significant  distance  from  front  lines 
(from  Headquarters  in  Paris  to  Sedan  is  about  100  miles  as  the  crow  flies),  called 
for  centralized  C2  exerted  over  an  apparently  robust  system  of  telephone  and 
telegraph  lines  through  Fronts  to  Armies  to  Corps  to  Divisions.27  Allied  C2 
systems  applied  redundancy  in  means  through  use  of  messengers  (both  human 
and  pigeon.)28  Radio  communications  was  scarce.  It  appeared  that  the  Allies 
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envisioned  a  war  moving  at  a  pace  similar  to  the  First  World  War,  in  which  units 
and  front  lines  moved  only  in  small  increments,  except  for  the  last  three  months 
of  that  war.29  If  the  pace  of  operations  were  like  that  of  WW1  then  the  Allied  C2 
doctrine  might  have  had  a  chance  of  working.  Instead,  the  Germans  practiced 
an  asymmetric  form  of  the  rapid  offensive,  concentrating  their  mobile  forces 
against  the  least  mobile  Allied  (French)  forces,  attacking  relentlessly,  disrupting 
Allied  lines  of  communications  and  operations  without  regards  to  their  own 
flanks,  causing  uncertainty,  paralysis,  mayhem  and  eventually  hopelessness 
within  Allied  Command.30  Allied  C2  doctrine  simply  was  non-adaptive,  and  broke 
under  the  stress  of  enemy  pressure. 

Case  5:  Successful  Human  Graceful  Degradation 

In  the  environment  of  military  C2,  the  commander  and  his/her  staff  is  the 
central  element  in  the  organizational  CAS.  How  they  cope  with  unexpected  and 
even  unanticipated  situations  often  determines  the  fate  of  armies.  Successful 
coping  or  adaptation  in  these  crisis  environments  is  synonymous  with  successful 
human  graceful  degradation.  Commanders  and  their  staffs  must  sense,  think, 
decide  and  direct  actions  within  organizational  systems  that  are  at  least  partially 
compromised  and  dysfunctional;  they  must  so  behave,  accomplishing  their  C2 
tasks  despite  failures  of  key  components  of  their  sensing,  communications,  and 
information  processing  sub-systems.  One  exemplary  illustration  of  this  capability 
is  the  case  of  RADM  Clifton  Sprague,  commander  of  Task  Group  77.3,  at  the 
Battle  off  Samar,  an  engagement  of  the  larger  battle  of  Leyte  Gulf,  25  October 
1944. 
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At  0645  hours  on  October  25,  1944,  RADM  Sprague  and  his  staff  looked 
forward  to  a  typical  morning  of  flight  operations  to  be  executed  by  his  task 
group,  one  small  element  of  the  7th  Fleet,  supporting  the  American  amphibious 
landings  on  Leyte,  the  Philippines.31  Two  earlier  naval  battles  had  occurred 
during  the  day  on  the  24th:  one  in  the  Sibuyan  Sea  to  the  west  of  Leyte  in  which 
naval  aircraft  from  ADM  William  Halsey's  powerful  3rd  Fleet  had  attacked  a  major 
Japanese  surface  force  commanded  by  ADM  Kurita;  the  second  fought  between 
surface  elements  of  the  7th  Fleet  under  VADM  Oldendorf  and  Japanese  forces 
under  ADM  Nishimura  in  the  early  hours  of  the  25th  in  Surigao  Strait  resulted  in 
the  almost  complete  annihilation  of  the  Japanese  fleet.  To  Sprague  it  looked 
like  the  Japanese  effort  to  disrupt  the  landings  had  failed.  Halsey's  fleet  now 
was  off  pursuing  a  Japanese  carrier  force  far  to  the  north;  everywhere  the 
Japanese  navy  appeared  to  be  in  retreat.  What  he  and  his  sailors  did  not  know 
was  that  after  the  Sibuyan  Sea  engagement,  Admiral  Kurita  had  reversed  course 
during  the  night,  turning  what  appeared  to  U.S.  naval  aviators  as  a  retreat  into  a 
quick  debouchment  from  the  San  Bernadino  Strait  and  directly  into  the  path  of 
Sprague's  little  task  group.  Sprague  and  the  rest  of  7th  Fleet  had  expected  ADM 
Halsey  to  provide  a  protective  cover  against  just  such  a  possibility;  however, 
Halsey  practiced  the  principle  of  mass  and  took  his  covering  force  with  him  in 
pursuit  of  the  Japanese  carriers.32  The  Americans  had  six  small  escort  carriers 
(top  speed  19  knots)  with  seven  destroyers  and  destroyer  escorts  as  protection 
for  the  carriers;  the  Japanese  had  four  battleships,  six  heavy  and  two  light 
cruisers,  and  eleven  destroyers  (overall  Japanese  fleet  average  top  speed  28 
knots.) 

At  0646  hours,  the  forces  made  contact,  first  through  an  aerial  sighting  by 
one  of  the  escort  carrier  pilots  followed  almost  immediately  by  lookouts  on  both 
sides.  Between  this  moment  and  time  and  approximately  0700  hours,  RADM 
Sprague  would  make  no  less  than  four  major  decisions,  exercising  personal  and 
direct  C2  over  his  small  and  terrifically  outgunned  force;  all  the  decisions  he 
made  were  the  best  possible  under  the  circumstances.  All  worked  to  his 
advantage.  First,  Sprague  ordered  his  entire  force  to  turn  into  the  wind,  with 
covering  destroyers  taking  the  flank  nearest  the  Japanese.  He  then  proceeded 
to  commence  an  immediate  launch  of  all  available  aircraft  -  no  matter  what 
armaments  they  were  covering  -  and  for  those  air  assets  to  attack  the  Japanese 
force.  He  also  recalled  previously  committed  air  assets  from  supporting  ground 
forces  on  Leyte  and  conducting  anti-submarine  patrols,  ordering  them  to  attack 
the  enemy  with  whatever  weapons  they  carried.  Sprague  adjusted  his  maneuver 
to  seek  a  nearby  rain  squall  to  further  provide  some  natural  cover  for  his  force; 
to  give  his  force  time  to  get  to  the  squall,  he  ordered  his  covering  force  to  lay 
down  a  smokescreen;  this  worked  well.  Sprague  had  his  staff  broadcast  a 
critically  urgent  call  for  help  on  all  available  radio  channels  -  in  the  clear  in  order 
to  save  time  associated  with  encryption.  Finally,  he  ordered  his  covering  force  to 
attack  the  enemy,  a  maneuver  that  his  screen  executed  with  extreme 
aggressiveness.  As  his  biographer  would  observe,  "He  disregarded  no  tactic,  no 
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matter  how  hopeless  it  might  appear...  He  utilized  his  interior  lines.  He 
maneuvered  through  his  own  smoke...  He  ordered  his  carriers  to  zigzag  and  to 
chase  enemy  shell  splashes..."33  All  these  actions  bought  his  force  about  ninety 
minutes  of  time;  but,  by  0900  the  Japanese,  who  had  commenced  firing  at  range 
shortly  after  sighting  Sprague's  ships  (mistaking  them  for  a  task  force  of  the  3rd 
Fleet),  had  significantly  closed  the  range,  thus  improving  the  accuracy  of  their 
fire;  his  screen  was  decimated  and  the  enemy  shells  started  hitting  his  carriers. 
USS  GAMBIER  BAY  was  the  first  carrier  to  get  hit  and  eventually  sunk  by  the 
Japanese.  Yet,  less  than  fifteen  minutes  later,  ADM  Kurita  turned  his  force  away 
from  Sprague,  and  headed  north.  The  little  Task  Group  77.3  somehow  had 
survived  a  massive  naval  assault  and  had  retained  control  of  their  part  of  the 
sea.  The  reasons  for  the  Japanese  retreat  have  been  discussed  over  the 
decades  since  the  battle;34  here  the  focus  is  on  Sprague's  decision-making  as  the 
key  part  of  the  C2  system. 

Clifton  Sprague  adapted  his  command  to  surmount  circumstances  for 
which  his  force  had  no  reason  to  train  for  or  to  expect  to  experience.  His 
decision  cycle  was  exceptionally  quick  -  most  significant,  it  was  far  quicker  than 
his  opponent's.  Of  interest  is  that  he  also  retained  control  of  his  forces 
throughout  this  chaotic  affair;  the  Japanese  leadership  did  not  -  Kurita  had 
allowed  a  "general  pursuit"  in  which  every  Japanese  ship  could  take  whatever 
action  necessary  to  close  with  and  destroy  the  enemy.  Sprague  demonstrated  a 
resilience  and  spirit  of  adaptation  in  command  that  commends  his  actions  to  all 
would-be  admirals  of  the  ocean  sea.  How  he  achieved  such  a  personal  C2 
capability  is  unremarkable.;;-  he  trained  for  this  kind  of  command  and  exercised  it 
repeatedly  over  his  naval  career.  Indeed,  it  was  his  ship,  USS  TANGIER,  that 
fired  the  opening  American  shots  of  the  Pacific  war  at  Pearl  Harbor,  three  years 
before  the  Leyte  action;  he  had  trained  his  staff  and  crew  to  expect  the 
unexpected;  when  that  happened,  specifically  in  the  instance  off  Samar  that 
morning  in  October,  1944,  the  right  commander  for  the  right  situation  was  in 
right  place. 

Case  6:  Unsuccessful  Human  Graceful  Degradation 

Albert  Einstein  supposedly  provided  a  definition  of  insanity:  doing  the 
same  thing  over  and  over  again  and  expecting  different  results.  When 
organizations,  as  well  as  individuals,  fail  to  adapt  to  their  environment,  their 
repeated  efforts  to  continue  their  normal  way  of  doing  things,  invariably  leading 
to  catastrophe,  constitutes  the  case  of  unsuccessful  human  graceful  degradation. 
Leadership  in  these  unfortunate  organizations  has  lost  resilience,  and  fixes  on 
the  present  means  in  a  vain  effort  to  force  a  desirable  future.  This  is  the  case  of 
Lieutenant  General  (LTG)  Courtney  Hodges,  commander  of  1st  Army,  European 
Theater  of  Operations,  and  his  subordinate  commanders  at  the  Huertgen  Forest 
campaign,  September  1944-January  1945. 
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The  Fluertgen  Forest  battle  was  the  longest  ground  engagement  fought  in 
the  European  Theater  of  Operations  (ETO).35  It  involved  no  less  than  120,000 
soldiers  on  the  American  side,  of  whom  over  31,000  became  casualties  (including 
over  6,800  battle  deaths.)  Of  the  five  divisions  that  eventually  participated  in  the 
battle,  two  were  rendered  hors  d' combat,  rendered  ineffective  due  to  excessive 
casualties.  On  average,  there  were  5,000  casualties  per  division  (authorized 
division  strength  approximately  17,000.)  Many  infantry  regiments  suffered  in 
excess  of  100%  casualties  over  the  duration  of  the  fight.  Yet,  the  battle 
effectively  led  to  nowhere,  and  even  the  official  history  describes  the  purpose  as 
one  merely  of  attrition.36  That  was  not  what  First  Army  expected. 

The  initial  reasons  for  the  Huertgen  Forest  battle  were  reasonable.  The 
Allied  ground  forces  in  the  ETO  were  pursuing  the  retreating  Germans  at  a  rapid 
pace  with  little  concern  about  flanks  or  reinforcing  lines  during  August  and  early 
September,  1944.  This  meant  that  ground  forces  were  scattered  with  fronts  far 
wider  than  what  normally  they  would  hold  in  less  mobile  times;  this  was  and  is 
an  essential  characteristic  of  maneuver  warfare.  However,  when  the  Allies 
approached  Germany,  they  ran  into  a  long  fortified  line  of  German  defenses, 
known  as  the  Westwall to  the  Germans  and  the  Siegfried  Line  to  the  Allies.  At 
first,  the  Allies,  and  First  Army  in  particular,  assaulted  this  line  in  their  spread 
formation.  LTG  Hodges  and  his  staff  focused  on  a  generally  West-East  line  from 
Aachen  to  Duren  as  a  direct  path  through  the  Siegfried  Line;  this  was  the  so- 
called  "Stolberg  Corridor."  Just  to  the  south  of  this  axis  of  advance  was  the 
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Heurtgen  Forest;  in  the  interest  of  protecting  the  flank  of  the  main  effort, 

Hodges  directed  that  one  infantry  division,  the  9th,  clear  the  forest  and  secure 
the  north-south  roads  that  the  Germans  could  use  to  move  units  to  bolster 
defenses.  The  first  problem  for  the  9th  Division  was  that  held  a  front  normally 
twice  as  wide  as  it  doctrinally  should  have  held,  encompassing  almost  the  entire 
forest.  The  second  problem  was  that  First  Army  had  given  the  division  several 
other  missions  in  addition  to  the  clearing  operation,  including  a  main  effort  along 
the  Corridor;  the  unit  could  not  concentrate  its  combat  power  on  just  one 
thing.37  The  physical  ground  of  the  forest  providers  a  formidable  foe  in  itself; 
the  forest  was4s  dense  cut  with  extremely  steep  gorges  eutcreated  by  small 
creeks  and  rivers.  The  Germans  held  the  high  ground  and  had  pre-registered 
the  area  with  artillery;  they  also  had  hundreds  of  concrete  "pillbox"  fortifications. 
Attackers  had  to  move  slowly  through  the  terrain,  without  much  friendly  armor, 
artillery  or  close  air  support  (a  decisive  Allied  capability),  against  an  entrenched 
foe.  The  result  was  a  bloody  repulse  that  left  two  of  the  three  regiments  of  the 
division  combat  ineffectivein  tatters.  If,  at  this  point,  LTG  Hodges,  his  staff,  and 
his  subordinate  commanders  had  learned  a  lesson  from  this  rebuff  and  not 
continued  their  efforts,  historians  may  have  written  this  first  battle  as  an 
unfortunate  footnote  to  a  deadly  conflict.  That  was  not  what  happened. 

The  main  First  Army  assault  through  the  Stolberg  Corridor  bogged  down 
due  to  significant  German  resistance.  General  Hodges  and  his  staff  began 
looking  to  the  Huertgen  Forest  as  a  flank  attack  to  take  pressure  off  the  main 
effort  immediately  to  the  north  in  the  Corridor.  Once  again  they  chose  a 
division,  the  28th,  to  attack  in  a  southeasterly  direction  towards  the  town  of 
Schmidt,  near  the  southeastern  end  of  the  forest.38  The  direction  of  the  assault 
would  force  the  division  through  the  densest  and  most  difficult  terrain  of  the 
forest,  without  any  transportation  lines  of  communication;  indeed,  the  division 
would  have  to  build  its  own  supply  roadtratl,  the  infamous  Kail  Trail,  to  enable  a 
line  of  communications  from  the  front.  The  division's  main  axis  of  advance,. 
including  the  supply  road,  was  completely  covered  by  German  artillery.  Equally 
important,  V  Corps,  responsible  for  the  planning  of  the  attack,  gave  the  Division 
three  distinct  objectives  that  faced  in  three  different  direction;  once  again,  a 
division  could  not  mass  its  combat  power  to  achieve  the  main  objective  -  the 
town  of  Schmidt.39  By  this  time,  about  two  weeks  after  the  9th  Division's 
experience,  the  Germans  had  moved  reinforcements  into  the  forest;  thus,  with 
approximately  the  same  firepower  as  the  9th  applied  (two  regiments),  the  28th 
Division  had  to  assault  into  the  worst  part  of  the  forest  in  which  the  enemy  had 
essentially  doubled  its  defensive  capabilities.  The  resulting  attack,  taking  place 
over  fourteen  days,  was  repulsed  with  extremely  heavy  casualties;  one  regiment 
effectively  ceased  to  exist.  Still  First  Army  leadership  remained  undaunted.  It 
replaced  the  battered  28th  Division  with  the  4th  Infantry  Division,  and  gave  it  the 
same  mission,  again  with  the  same  divergent  tasks.  In  this  case,  though,  the 
4th  received  help  from  the  8th  Infantry  Division.  LTG  Hodges  had  recognized  that 
one  division  was  insufficient  to  manage  the  Huertgen;  the  8th  was  to  attack 
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parallel  and  south  of  the  4th.  Unfortunately,  the  result  was  only  mildly  different; 
the  4th  was  able  to  advance  to  some  high  ground  in  the  eastern  part  of  the 
forest;  the  8th  was  to  reach  the  approaches  and  high  ground  overlookinqf 
Schmidt,  taken  and  lost  by  the  28th  more  than  three  weeks  earlier.40 

During  these  two  months  of  intense  combat,  none  of  the  First  Army 
leadership  or  planners  visited  the  terrain  into  which  they  were  sending  divisions. 
Equally  astonishing,  it  seems  that  the  Corps  commanders  (MG  Gerow  of  V  Corps 
and  MG  Collins  of  VII  Corps),  who  held  the  responsibility  for  detailed  planning  of 
the  attacks,  also  did  not  reconnoiter  the  terrain.41  The  human  C2  system  had 
virtually  no  situational  awareness  of  the  operational  environment.  General 
Hodges  and  First  Army  headquarters  held  the  responsibility  to  frame  the 
operational  picture  in  which  his  corps  and  division  units  would  operate;  he 
personally  approved  all  plans;  he  was  responsible  to  provide  the  commander's 
intent  for  his  subordinates  to  execute.  First  Army  also  had  the  major  support 
responsibility  for  fighting  units.  The  framing  lacked  situational  understanding; 
the  plans  were  faulty  and  failed  in  the  extreme;  Hodges  never  truly  provided  a 

good  reason  for  the  entire  effort.42  Instead  of  learning  from  what  had  happened 
to  his  units,  Hodges  merely  reinforced  failure,  almost  as  an  autonomic  reflex  - 
the  enemy  is  there,  go  fight  them.  What  was  worse  is  that  he  micro-managed 
his  army,  and  held  his  subordinate  commanders  on  short  leash;  this  led  to 
subordinate  commanders  watching  over  their  shoulders,  and  providing  overly 
optimistic  situation  reports  to  get  the  higher  headquarters  off  their  backs.43  This 
poisonous  C2  atmosphere  resulted  in  no  one  questioning  the  reason  for  attacking 
into  the  Huertgen  Forest  when  other  options  (flanking  and  blocking  maneuvers) 
were  available;  only  in  mid-December  did  one  senior  leader,  MG  James  Gavin, 
acting  commander  of  XVIII  Airborne  Corps,  actually  visit  the  battlefield,  witness 
the  carnage,  and  return  to  First  Army  headquarters,  asking  the  question:  why 
attack  into  the  Huertgen  in  the  first  place?  He  never  received  an  answer.44 

Observations  and  Recommendations 

This  paper  has  introduced  the  concept  of  graceful  degradation  to  the 
command  and  control  discipline;  it  is  the  ability  of  a  system  to  continue 
functioning  even  in  face  of  critical  sub-systems/component  failure  or  malfunction. 

It  has  developed  the  concept  based  on  resilience,  which  itself  is  based  on 
redundancy  and  robustness.  The  paper  has  discussed  several  and  diverse 
schools  of  thought  on  resilience  which  in  turn  is  directly  and  strongly  correlated 
with  graceful  degradation.  It  presented  six  cases  of  the  three  fundamental 
aspects  of  a  command  and  control  system  (hardware,  software,  humanware): 
three  successful  and  three  unsuccessful. 

Based  on  the  review  of  the  different  domains  as  well  as  the  case  studies, 
the  authors  provide  the  following  overarching  considerations  in  applying 
resilience  thinking  as  a  means  for  achieving  graceful  degradation.  These 
considerations  will  require4s  continually  analysis  and  assessments  for 
improved  design  characteristic  and  capabilities  within  our  organizational  and 
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technological  C2  systems,  as  well  as,  inculcating  the  concepts  into  the  minds  of 
current  and  future  leaders.  One  can  understand  these  considerations  as 
guidelines  for  a  research  program  on  graceful  degradation  in  C2  systems. 


•  Resilience  requires  trade-offs  (these  tradeoffs  can  either  occur 
within  one  particular  system  or  across  different  systems  within  a  family 
of  systems)  and  increases  near-term  "costs"45 

o  Increasing  resilience  at  one  level  of  the  system  can  decrease 
resilience  at  another  level 

o  Increasing  resilience  in  one  system  aspect  can  decrease 
resilience  in  another  system  aspect 
o  Increasing  resilience  (through  redundancy)  implies  decreased 
efficiency  (e.g.  increased  costs  without  commensurate  short¬ 
term  opportunity  gains) 

•  Resilience  requires  change;  a  system  needs  to  experience  a  shock 
or  perturbation  (which  can  be  simulated  rather  than  actual)  in  order  to 
learn  and  adapt.  Methods  that  attempt  to  prevent  all  crises,  to  sustain 
a  system  in  the  short-term,  can  decrease  resilience  in  the  long  term.46 
However,  it  is  just  as  important  have  methods  that  prevent  large, 
catastrophic  shocks  that  would  result  in  the  system  being  unable  to 
accomplish  its  mission.  Historically,  the  military  has  implemented  a 
number  of  practices  to  achieve  graceful  degradation  for  operations  in 
persistent  and  non-persistent  chemical  environments  and  for 
operations  with  limited  communications  capability  (either  deliberate  or 
consequential).  These  techniques  ranged  from  developing  the 
expectations  and  rules  of  thumb  for  operating  tempo  slow-downs; 
training  and  rehearsals  in  the  form  of  individual  soldier  tasks,  unit 
tasks,  and  larger  exercises;  to  the  use  radio  silence  and  signal 
operating  instructions.47  Additionally,  in  response  to  the  Soviet  threat 
in  the  1970's/1980's,  each  Service  established  training  environments 
(the  Army's  National  Training  Center,  the  Air  Force's  Red  Flag,  and  the 
Navy's  Top  Gun)  that  sought  to  present  extremely  difficult  tactical  and 
operational  challenges  to  military  forces  in  order  for  them  to  learn, 
adapt,  and  increase  their  resilience.  These  environments  parallel 
similar  efforts  undertaken  by  the  military  during  the  interwar  years 
(between  WWI  and  WWII)  such  as  the  Naval  War  College  Rainbow 
Wargames  and  the  Louisiana  Maneuvers. 

•  Resilience  requires  an  acceptance  of  unpredictability.  As  we 
alluded  to  earlier,  CAS  behaviors  and  environments  cannot  be  fully 
predicted  or  even  completely  understood;  therefore,  managing  for 
resilience  requires  that  we  understand  and  accept  the  inherent 
"unknowability"  of  our  system.  Uncertainty  is  a  fundamental  limitation 
to  how  much  we  can  understand  about  our  world.48  Accepting 
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uncertainty,  however,  does  not  imply  abdicating  a  responsibility  to 
reduce  the  "unknown-unknowns"  (by  increasing:  1)  the  "known- 
knowns"  -  those  things  that  we  know,  we  know;  2)  the  "known- 
unknowns"  -  those  things  that  we  know,  we  do  not  know;  and  3)  the 
"unknown-knowns"  -  those  things  that  we  knew  previously  but  have 
forgotten  and  those  things  that  we  know,  but  are  unaware  that  we 
know).  Focusing  on  general  resilience  -  the  ability  of  a  system  to 
absorb  unforeseen  disturbances  -  allows  a  system  to  be  designed  for 
exapation  (creating  systems  and  processes  which  allow  things  to  come 
together  in  radical  and  novel  ways).49 

•  Increased  resilience  is  dependent  upon  selecting  actions  that 
are  informed  by  the  existing  system  state:  the  same  action  can 
increase  or  decrease  resilience  based  on  the  state  of  the 

system. Resilience  requires  leaders  and  managers  in  the  system  to 
focus  on  coping  mechanisms  rather  than  optimizing  mechanisms.50 
General  Dempsey,  in  his  "Mission  Command  White  Paper"  advocates 
for  the  military  to  train  commanders  on  how  to  avoid  information 
overload  and  "paralysis  by  analysis"  and  to  allow  the  commander  to 
rehearse  making  rapid  decisions  without  perfect  or  complete 
information.51 

Since  any  disturbance  or  change  can  lead  to  increased  resilience,  then 
any  action  taken  to  "disturb"  an  adversary  could  increase  their 
resilience  and  decrease  our  own  resilience. 

•  Resilience  requires  a  culture  that: 

o  Allows  a  variety  of  leadership  styles  and  multiple  leadership 
roles  vested  in  different  individuals 

o  Fosters  a  high  degree  of  trust  (up  and  down  as  well  as  laterally) 
and  a  requirement  to  know  the  mission  partners  -  their 
authorities,  decision-making  culture,  and  how  they 
communicate52 

o  Uses  decision  making  processes  and  criteria  that  seek  to  retain 
all  options  open53;  to  having  alternatives,  the  ability  to  grab  an 
emergent  opportunity. 

o  Provides  the  capacity  and  capability  to  self-organize  and 
reorganize,  i.e.  to  move  around  different  classes  of  C2 
approach:  Edge  C2,  Collaborative  C2,  Coordinated  C2,  De- 
Conflicted  C2,  and  Conflicted  C254 

In  the  recently  published  Capstone  Concept  for  Joint  Operations:  Joint  Force 
2020,  the  United  States  Joint  Chiefs  of  Staff  articulate  the  requirement  for  a 
commitment  to  the  use  of  mission  command  as  the  most  appropriate  command 
philosophy  to  empower  decentralized  subordinate  leaders  to  exercise  judgment 
in  their  actions  to  advance  the  commander's  intent.55  This  same  document 
recognizes  that  mission  command  may  not  be  appropriate  for  all  situations  and 
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that  each  of  the  Services  implement  different  versions  of  mission  command.  As 
a  result,  this  document  provides  six  implications  with  respect  to  C2  and  two 
implications  with  respect  to  intelligence.  Embedded  within  these  eight 
implications  lay  ideas  that  would  support  graceful  degradation  such  as:  educating 
commanders  and  staffs  to  match  command  philosophy  to  the  particular 
requirements  of  each  mission,  regularly  training  the  force  to  operate  in  "worst 
case"  degraded  environments,  making  a  common  set  of  command  and  control 
applications  available  as  cloud  services,  building  greater  resilience  into  technical 
architectures,  developing  capabilities  and  tradecraft  that  provide  broader 
intelligence  to  decision  makers,  and  improving  the  capabilities  that  fuse,  analyze, 
and  exploit  large  data  sets.56  Each  of  these  ideas  supports  the  adoption  of 
graceful  degradation  as  a  C2  virtue;  together,  they  address  the  key  issues 
revealed  from  the  six  cases  of  hardware,  software,  and  "humanware"  aspects. 
What  remains  is  the  extent  to  which  the  ideas  are  translated  into  programs,  and 
the  programs  in  turn  converted  to  reality. 
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Key  Terms  for  Graceful  Degradation 


Robustness 

Resistance  to  change 
Resistance  to  uncertainty 


Graceful  degradation  occurs  by  virtue  of  the  interaction  of 
3  aspects  of  system  design 

1.  Hardware  (Technology) 

2.  Software  (Doctrine,  procedures,  instructions) 

3.  The  human  interface  between  hardware  &  software 


Redundancy 

Active 

Passive 

Type 

Action 


System 

Resilience 


Graceful 

Degradation 


System 

Performance 
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Key  Terms  for  Graceful  Degradation 


System 

Performance 


The  ability  of  a  system  to 
perform  a  specified  function 


Key  Terms  for  Graceful  Degradation 


The  properties  that  enable  a  system  to 
continue  operating  in  the  event  of  the 
failure  in  some  of  its  components 


Graceful 

Degradation 


System 

Performance 


Key  Terms  for  Graceful  Degradation 


System 

Resilience 


Graceful 

Degradation 


System 

Performance 


The  ability  of  a  system 
to  tolerate  stress 


Key  Terms  for  Graceful  Degradation 


Robustness 

Resistance  to  change 
Resistance  to  uncertainty 


The  strength  of  a  system: 

•  Ability  to  resist  changes  from  both  in/out 

•  Ability  to  resist  the  uncertainties  associated 
with  system  processes 


System 

Resilience 


Graceful 

Degradation 


System 

Performance 
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Key  Terms  for  Graceful  Degradation 


Robustness 


Resistance  to  change 
Resistance  to  uncertainty 


Redundancy 

Active 

Passive 

Type 

Action 


Graceful 

Degradation 


System 

Performance 


A  multiplicity  of  probable  system  operational  capabilities 

•  Active:  Alternate  system  components  can 
accomplish  the  same  thing 

•  Passive:  A  non-operational  "back-up"  component  is 
available 


Domain  Review  of  Resilience 


Degree 


of  Complexity 


Insights 


Materials 

Engineering 

Systems 

Engineering 

Social-ecological 
System  Mgt 

Critical  Infrastructure 
Mgt 

Discrete  part  of 
the  system 

Groups  of 
interacting  parts 

Adaptive  Capacity 

System  Protection 

Design  the  system  Design  the  system  as  Design  the  system  to 

part  to  endure  a  whole  to  tolerate  withstand  both 

stress/minimize  stress  and  adapt  unintentional  and 

change  intentional  damage 

Assumes  there  is 
one  “normal” 
state  to  which  a 
system  returns 
after  a 
disturbance 

•  The  “parts”  of  these 
systems  are 
inherently  adaptable 

•  Explicitly 
recognizes  humans 
as  part  of  the 

Tightly-coupled 
systems  with  circular, 
reciprocal 

dependencies  can  lead 
to  cascading  or 
escalating  failures  in 

system 
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Six  Case  Studies  on  Graceful  Degradation 


•  Hardware 

-  Successful:  USS  San  Francisco,  Guadalcanal  - 1942 

-  Unsuccessful:  Hurricane  Katrina  -  2005 

•  Software 

-  Successful:  Battle  of  Wanat  -  2008 

-  Unsuccessful:  Operation  Fall  Gelb- 1940 

•  Human  Interface 

-  Successful:  Task  Group  77.3,  Battle  off  Samar  - 1944 

-  Unsuccessful:  1st  Army,  Huertgen  Forest  Campaign  - 1944 


Observations  and  Recommendations 


•  Resilience  requires  trade-offs 

•  Resilience  requires  disturbances 

•  Resilience  requires  an  acceptance  of  unpredictability 

•  Increasing  resilience  is  dependent  upon  selecting 
actions  that  are  informed  by  the  existing  system  state 

•  Resilience  requires  a  culture  that: 

-  Allows  a  variety  of  leadership  styles 

-  Fosters  a  high  degree  of  trust 

-  Uses  decisions  that  retain  all  options  open 

-  Provides  the  capacity  and  capability  to  self-organize  & 
reorganize 
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CCJO  and  Graceful  Degradation 


*  Educate  commanders  and  staffs  to  match  their 
command  philosophy  to  the  particular  requirements 
of  each  mission 

*  Regularly  train  the  force  to  operate  in  “worst  case” 
degraded  environments 

*  Make  a  common  set  of  C2  applications  available  as 
cloud  services 

*  Build  greater  resilience  into  technical  architectures 

*  Develop  capabilities  and  tradecraft  that  provide 
broader  intelligence  to  decision  makers 

*  Improve  the  capabilities  that  fuse,  analyze,  &  exploit 
large  data  sets 
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